General
-
Target
7d847a83feccb880f9662cee0d5fdd5f254d4aeb68a0eb2dfc62cec2440771ab
-
Size
674KB
-
Sample
240727-btsrea1brf
-
MD5
a3c73c7f1c311441d3a9f977704479c6
-
SHA1
ee741f02fb55c4c2fa3963dc82b4499af670c120
-
SHA256
7d847a83feccb880f9662cee0d5fdd5f254d4aeb68a0eb2dfc62cec2440771ab
-
SHA512
02267e6586a34c90549e2cd98e9ed30bb41095c7e6c8113a38aa9ce7d15941f0e193fdeaabf5b5c4dc8a5ce3e10a5dc1d0d466f9e689318d615f2f682863d67f
-
SSDEEP
12288:GDfbNnH0nDBrFnhZHk/rP4N4wAcRwesQGgWa7dIqANQ7kR:G/NH0DBrRhZE/rP4N44sQG8dLe
Static task
static1
Behavioral task
behavioral1
Sample
7d847a83feccb880f9662cee0d5fdd5f254d4aeb68a0eb2dfc62cec2440771ab.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
7d847a83feccb880f9662cee0d5fdd5f254d4aeb68a0eb2dfc62cec2440771ab.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@# - Email To:
[email protected]
Extracted
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@#
Targets
-
-
Target
7d847a83feccb880f9662cee0d5fdd5f254d4aeb68a0eb2dfc62cec2440771ab
-
Size
674KB
-
MD5
a3c73c7f1c311441d3a9f977704479c6
-
SHA1
ee741f02fb55c4c2fa3963dc82b4499af670c120
-
SHA256
7d847a83feccb880f9662cee0d5fdd5f254d4aeb68a0eb2dfc62cec2440771ab
-
SHA512
02267e6586a34c90549e2cd98e9ed30bb41095c7e6c8113a38aa9ce7d15941f0e193fdeaabf5b5c4dc8a5ce3e10a5dc1d0d466f9e689318d615f2f682863d67f
-
SSDEEP
12288:GDfbNnH0nDBrFnhZHk/rP4N4wAcRwesQGgWa7dIqANQ7kR:G/NH0DBrRhZE/rP4N44sQG8dLe
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1